I don't need no stinking firewall!
rsk at gsp.org
Wed Jan 6 02:20:31 UTC 2010
A firewall is another layer in a defense-in-depth strategy, but tends
to only be truly effective if the first rule in it is
deny all from any to any
which of course does not happen much of the time in the real world,
with predictable results.
Moreover, stateful packet inspection is not the end-all be-all: there's
a lot to be said for application-level proxying, and for quasi-realtime
I think of my firewalls as tools which reduce the overwhelming flood
of malicious and garbage traffic to a trickle -- which does not necessarily
reduce the attack surface or the threats to it, but may at least allow
me a better chance of seeing the threats and doing something useful
More information about the NANOG